Bug 167615

Summary: NULL-deref crash in TextTrack::removeCue()
Product: WebKit Reporter: Jer Noble <jer.noble>
Component: New BugsAssignee: Jer Noble <jer.noble>
Status: REOPENED ---    
Severity: Normal CC: ap, buildbot, calvaris, cdumez, commit-queue, eric.carlson, esprehn+autocc, gyuyoung.kim, philipj, rniwa, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=166635
Attachments:
Description Flags
Patch
none
Patch
eric.carlson: review+
Patch for landing
commit-queue: commit-queue-
Archive of layout-test-results from webkit-cq-01 for mac-elcapitan
none
Archive of layout-test-results from ews117 for mac-elcapitan
none
Archive of layout-test-results from ews105 for mac-elcapitan-wk2
none
Patch for landing none

Description Jer Noble 2017-01-30 16:47:07 PST
NULL-deref crash in TextTrack::removeCue()
Comment 1 Jer Noble 2017-01-30 16:49:26 PST
rdar://problem/30106362
Comment 2 Jer Noble 2017-01-30 16:50:01 PST
Created attachment 300159 [details]
Patch
Comment 3 Eric Carlson 2017-01-30 17:02:03 PST
Caused by changes for bug 166635.
Comment 4 WebKit Commit Bot 2017-01-30 18:39:30 PST
Comment on attachment 300159 [details]
Patch

Clearing flags on attachment: 300159

Committed r211401: <http://trac.webkit.org/changeset/211401>
Comment 5 WebKit Commit Bot 2017-01-30 18:39:35 PST
All reviewed patches have been landed.  Closing bug.
Comment 6 Alexey Proskuryakov 2017-01-31 10:30:02 PST
Can this be tested with a regression test?
Comment 7 Jer Noble 2017-01-31 14:10:57 PST
Reopening to attach new patch.
Comment 8 Jer Noble 2017-01-31 14:11:00 PST
Created attachment 300258 [details]
Patch
Comment 9 Eric Carlson 2017-01-31 14:21:52 PST
Comment on attachment 300258 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=300258&action=review

> LayoutTests/http/tests/media/track-in-band-hls-metadata-crash.html:21
> +
> +

Nit: extra blank line.

> LayoutTests/http/tests/media/track-in-band-hls-metadata-crash.html:22
> +            function cuechange() {

Nit: brace on the next line (or change the other functions to match this).

> LayoutTests/http/tests/media/track-in-band-hls-metadata-crash.html:41
> +        <img id=photo>

Nit: this element isn't used.

> LayoutTests/http/tests/media/track-in-band-hls-metadata-crash.html:42
> +        <p>Test for metadata tracks from Apple HLS stream.</p>

Nit: might as well update this comment.
Comment 10 Jer Noble 2017-01-31 14:26:12 PST
Created attachment 300259 [details]
Patch for landing
Comment 11 WebKit Commit Bot 2017-01-31 15:29:35 PST
Comment on attachment 300259 [details]
Patch for landing

Rejecting attachment 300259 [details] from commit-queue.

New failing tests:
http/tests/media/track-in-band-hls-metadata-crash.html
Full output: http://webkit-queues.webkit.org/results/2981523
Comment 12 WebKit Commit Bot 2017-01-31 15:29:40 PST
Created attachment 300270 [details]
Archive of layout-test-results from webkit-cq-01 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the commit-queue.
Bot: webkit-cq-01  Port: mac-elcapitan  Platform: Mac OS X 10.11.6
Comment 13 Build Bot 2017-01-31 15:44:22 PST
Comment on attachment 300259 [details]
Patch for landing

Attachment 300259 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/2981541

New failing tests:
http/tests/media/track-in-band-hls-metadata-crash.html
Comment 14 Build Bot 2017-01-31 15:44:27 PST
Created attachment 300276 [details]
Archive of layout-test-results from ews117 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews117  Port: mac-elcapitan  Platform: Mac OS X 10.11.6
Comment 15 Build Bot 2017-01-31 15:45:12 PST
Comment on attachment 300259 [details]
Patch for landing

Attachment 300259 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/2981601

New failing tests:
http/tests/media/track-in-band-hls-metadata-crash.html
Comment 16 Build Bot 2017-01-31 15:45:17 PST
Created attachment 300277 [details]
Archive of layout-test-results from ews105 for mac-elcapitan-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews105  Port: mac-elcapitan-wk2  Platform: Mac OS X 10.11.6
Comment 17 Jer Noble 2017-02-01 09:57:38 PST
Created attachment 300334 [details]
Patch for landing
Comment 18 WebKit Commit Bot 2017-02-01 10:23:46 PST
Comment on attachment 300334 [details]
Patch for landing

Clearing flags on attachment: 300334

Committed r211495: <http://trac.webkit.org/changeset/211495>